SEC401 took what I thought I knew and truly explained everything to me. Now, I also UNDERSTAND the security essentials fundamentals and how/why we apply them. Loved the training, cannot wait to come back for more.

Nicholas Blanton, ManTech International

Learn the most effective steps to prevent attacks and detect adversaries with actionable techniques that you can directly apply when you get back to work. Learn tips and tricks from the experts so that you can win the battle against the wide range of cyber adversaries that want to harm your environment.

Is SEC401: Security Essentials Bootcamp Style the right course for you?

STOP and ask yourself the following questions:

Do you fully understand why some organizations get compromised and others do not?

If there were compromised systems on your network, are you confident that you would be able to find them?

Do you know the effectiveness of each security device and are you certain that they are all configured correctly?

Are proper security metrics set up and communicated to your executives to drive security decisions?

If you do not know the answers to these questions, SEC401 course will provide the information security training you need in a bootcamp-style format that is reinforced with hands-on labs.

To develop effective security metrics that provide a focused playbook that IT can implement, auditors can validate, and executives can understand

To analyze and assess the risk to your environment in order to drive the creation of a security roadmap that focuses on the right areas of security

Practical tips and tricks to focus in on high-priority security problems within your organization and on doing the right things that will lead to security solutions that work

Why some organizations are winning and some are losing when it comes to security and, most importantly, how to be on the winning side

The core areas of security and how to create a security program that is anchored on PREVENT-DETECT-RESPOND.

Learn to build a security roadmap that can scale today and into the future.

SEC401: Security Essentials Bootcamp Style is focused on teaching you the essential information security skills and techniques you need to protect and secure your organization's critical information assets and business systems. Our course will show you how to prevent your organization's security problems from being headline news in the Wall Street Journal!

"Prevention is Ideal but Detection is a Must."

With the rise in advanced persistent threats, it is almost inevitable that organizations will be targeted. Whether the attacker is successful in penetrating an organization's network depends on the effectiveness of the organization's defense. Defending against attacks is an ongoing challenge, with new threats emerging all of the time, including the next generation of threats. Organizations need to understand what really works in cybersecurity. What has worked, and will always work, is taking a risk-based approach to cyber defense. Before your organization spends a dollar of its IT budget or allocates any resources or time to anything in the name of cybersecurity, three questions must be answered:

What is the risk?

Is it the highest priority risk?

What is the most cost-effective way to reduce the risk?

Security is all about making sure you focus on the right areas of defense. In SEC401 you will learn the language and underlying theory of computer and information security. You will gain the essential and effective security knowledge you will need if you are given the responsibility for securing systems and/or organizations. This course meets both of the key promises SANS makes to our students: (1) You will learn up-to-the-minute skills you can put into practice immediately upon returning to work; and (2) You will be taught by the best security instructors in the industry.

Assessment Available

This course prepares you for the GSEC certification that meets the requirement of the DoD 8570 IAT Level 2.

Course Content Overlap Notice:

Please note that some course material for SEC401 and MGT512 may overlap. We recommend SEC401 for those interested in a more technical course of study, and MGT512 for those primarily interested in a leadership-oriented but less technical learning experience.

Course Syllabus

SEC401.1: Networking Concepts

Overview

A key way that attackers gain access to a company's resources is through a network connected to the Internet. A company wants to try to prevent as many attacks as possible, but in cases where it cannot prevent an attack, it must detect it in a timely manner. Therefore, an understanding of how networks and the related protocols like TCP/IP work is critical to being able to analyze network traffic and determine what is hostile. It is just as important to know how to protect against these attacks using devices such as routers and firewalls. These essentials, and more, will be covered during this course day in order to provide a firm foundation for the consecutive days of training.

CPE/CMU Credits: 8

Topics

Setting Up a Lab with Virtual Machines

Use

Implementation

Security

Network Fundamentals

Network types (LANs, WANs)

Network topologies

LAN protocols

WAN protocols

Network devices

IP Concepts

Packets and addresses

IP service ports

IP protocols

TCP

UDP

ICMP

DNS

IP Behavior

TCP dump

Recognizing and understanding

UDP

ICMP

UDP behavior

Virtual Machines

Use

Implementation

Security

SEC401.2: Defense In-Depth

Overview

To secure an enterprise network, you must have an understanding of the general principles of network security. In this course, you will learn about six key areas of network security. The day starts with information assurance foundations. Students look at both current and historical computer security threats, and how they have impacted confidentiality, integrity, and availability. The first half of the day also covers creating sound security policies and password management, including tools for password strength on both Unix and Windows platforms. The second half of the day is spent on understanding the information warfare threat and the six steps of incident handling. The day draws to a close by looking at attack strategies and how the offense operates.

CPE/CMU Credits: 8

Topics

Information Assurance Foundations

Defense in-depth

Confidentiality, integrity, and availability

Risk model

Authentication vs. authorization

Vulnerabilities

Defense in-depth

Computer Security Policies

Elements when well written

How policies serve as insurance

Roles and responsibilities

Contingency and Continuity Planning

Business continuity planning (BCP)

Disaster recovery planning (DRP)

Business impact analysis

Access Control

Data classification

Authentication, authorization, accountability (AAA)

MAC and DAC

Password Management

Password cracking for Windows and Unix

Alternate forms of authentication (tokens, biometrics)

Single sign-on and RADIUS

Incident Response (IR)

Preparation, identification, and containment

Eradication, recovery, and lessons learned

Investigation techniques and computer crime

Legal issues associated with IR

Offensive and Defensive Information Warfare (IW)

Types of IW

APT

Asymmetric warfare

Offensive goals

Attack Strategies and Methods

How the adversary breaks into systems

Mitnick attack

Attack methods

SEC401.3: Internet Security Technologies

Overview

Military agencies, banks, and retailers offering electronic commerce programs, as well as dozens of other types of organizations, are striving to understand the threats they are facing and what they can do to address those threats. On day 3, you will be provided with a roadmap to help you understand the paths available to organizations that are considering deploying or planning to deploy various security devices and tools such as intrusion detection systems and firewalls. When it comes to securing your enterprise, there is no single technology that is going to solve all your security issues. However, by implementing an in-depth defense strategy that includes multiple risk-reducing measures, you can go a long way toward securing your enterprise.

CPE/CMU Credits: 8

Topics

Vulnerability Scanning and Remediation

Approaches and methods of remediation

Building a network visibility map

Host identification

Port scanning

Vulnerability scanning

Penetration testing

Web Security

Web communication

Web security protocols

Active content

Cracking web applications

Web application defenses

Firewalls and Perimeters

Types of firewalls

Pros and cons of firewalls

Firewall placement

Packet filtering, stateful, and proxies

Honeypots

Forensics

Honeypots

Honeynets

Honey tokens

Host-based Protection

Intrusion detection

Intrusion prevention

Tripwire

Pros and cons

Network-based Intrusion Detection and Prevention

Pros and cons

Deployment strategies

Snort

Development and advances

SEC401.4: Secure Communications

Overview

There is no silver bullet when it comes to security. However, there is one technology that would help solve a lot of security issues, though few companies deploy it correctly. This technology is cryptography. Concealing the meaning of a message can prevent unauthorized parties from reading sensitive information. Day 4 looks at various aspects of encryption and how it can be used to secure a company's assets. A related area called steganography, or information hiding, is also covered. The day finishes by looking at using the Critical Security Controls for metrics based dashboards and performing risk assessment across an organization.

CPE/CMU Credits: 8

Topics

Cryptography

Need for cryptography

Types of encryption

Symmetric

Asymmetric

Hash

Ciphers

Digital substitution

Algorithms

Real-world cryptosystems

Crypto attacks

VPNs

Types of remote access

PKI

Digital certificates

Key escrow

Steganography

Types

Applications

Detection

Critical Security Controls

Overview of the controls

Implementing the controls

Auditing the Controls

Specific controls and metrics

Risk Assessment and Auditing

Risk assessment methodology

Risk approaches

Calculating risk

SLE

ALE

SEC401.5: Windows Security

Overview

Windows is the most widely-used and hacked operating system on the planet. At the same time, the complexities of Active Directory, PKI, BitLocker, AppLocker, and User Account Control represent both challenges and opportunities. This section will help you quickly master the world of Windows security while showing you the tools that can simplify and automate your work. You will complete the day with a solid grounding in Windows security, by looking at automation, auditing and forensics.

CPE/CMU Credits: 8

Topics

Security Infrastructure

Windows family of operating systems

Workgroups and local accounts

What is Active Directory?

Domain users and groups

Kerberos, NTLMv2, smart cards

Forests and trusts

What is group policy?

Service Packs, Patches, and Backups

Service packs

E-mail security bulletins

Patch installation

Automatic updates

Windows server update services

Windows backup

System restore

Device driver rollback

Permissions and User Rights

NTFS permissions

File and print sharing service

Shared folders

BitLocker drive encryption

Security Policies and Templates

Group policy objects

Password policy

Lockout policy

Anonymous access

Software restriction policies

Securing Network Services

Firewalls and packet filtering

IPSec and VPNs

Wireless networking

Security configuration wizard

Remote desktop protocol (RDP)

Auditing and Automation

Microsoft baseline security analyzer

SECEDIT.EXE

Windows event logs

NTFS and registry auditing

IIS logging

Creating system baselines

Scripting tools

Scheduling jobs

SEC401.6: Unix/Linux Security

Overview

While organizations do not have as many Unix/Linux systems, those that they do have are often some of the most critical systems that need to be protected. Day 6 provides step-by-step guidance to improve the security of any Linux system. The course combines practical "how to" instructions with background information for Linux beginners, as well as security advice and best practices for administrators of all levels of expertise.

CPE/CMU Credits: 6

Topics

Linux Landscape

Different variants of and uses for Linux

Ways processes are started

Network interface information

Process information

Directory hierarchy

Partitions and OS installation

Permissions and User Accounts

Setting permissions

SUID and SGID

Controlling access

Root vs. user accounts

Setting password controls

Pluggable authentication module (PAM)

Linux OS Security

Dangerous services

Helpful services

Running and stopping programs

Configuration changes and restarting services

File system permissions, ownership, and systems

Mounting drives

Maintenance, Monitoring, and Auditing Linux

Common causes of compromise

Patching

Backing up data

Syslog

Analyzing log files

Other logging

Linux Security Tools

File integrity verifications

Chkrootkit

CIS hardening guides

Bastille linux

Sniffers

Snort

Additional Information

Testimonial

To give you an idea of the effectiveness of the course, here is what a few former students have said about it:

"Excellent material for security professionals wanting a deeper level of knowledge on how to implement security policies, procedures, and defensive mechanisms in an org." - Brandon Smit, Dynetics

"SEC401 took what I thought I knew and truly explained everything to me. Now, I also UNDERSTAND the security essentials fundamentals and how/why we apply them. Loved the training, cannot wait to come back for more." - Nicholas Blanton, ManTech International

Laptop Required

Security 401: Security Essentials Bootcamp Style consists of course instructions and hands-on sessions. To reinforce the skills covered in class and gain experience with the tools needed to implement effective security, there are hands-on labs every day. These lab sessions are designed to enable students to use the knowledge gained throughout the course in an instructor-led environment. Students will have the opportunity to install, configure, and utilize the tools and techniques that they have learned.

Students will require a system running Windows 8.x and Kali Linux with the following requirements:

Administrator access to the operating system and all security software installed. Changes need to be made to personal firewalls and other host-based software in order for the labs to work.

Anti-virus software will need to be disabled in order to install some of the tools.

A DVD player is required to install the tools that will be provided in class.

Students are required to bring their own laptops that are properly configured. There is not enough time in class to help you install your laptop, so please note that your laptop must be properly installed and configured before you come to class. Students are also required to test their systems prior to coming to class. Do not bring a regular production laptop to this class! When installing software, there is always a chance of breaking something else on the system. Students should assume that all data could be lost.

Students must bring a laptop with Windows 8.x installed. The recommended configuration is Windows 8 as the host operating system running Kali Linux as a virtual machine with VMWare Player. Students can use a Mac or Linux system with a different virtual machine product running both Windows and Kali Linux on virtual machines, but the specific details for setting it up are left to the student.

Students MUST also download/install VMWare Player and Kali Linux prior to coming to class.

Confirm that you can start up Kali Linux and run a program. *In addition, a DVD will be provided in class that contains the proper version of Kali Linux.

NOTE: The labs are written for Windows 8; however all of the tools will run in Windows 7 and the screen shots for running the tools are the same. The only difference is since there is no start menu in Windows 8 the method for accessing a DVD and initially running a program are different. If you know how to open a DVD and run a program in Windows 7, you will be able to use Windows 7 for the labs.

By properly preparing, you will have a knowledge-rich and enjoyable lab experience.

If you have any questions, feel free to contact us.

Sincerely,

Dr. Eric Cole

Track Lead/Course Author

E-mail: eric@sans.org

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

Who Should Attend

Anyone who works in security, is interested in security, or has to understand security should take this course, including:

Security professionals who want to fill the gaps in their understanding of technical information security

Operations personnel who do not have security as their primary job function but need an understanding of security to be effective

IT engineers and supervisors who need to know how to build a defensible network against attacks

Administrators responsible for building and maintaining systems that are being targeted by attackers

Forensic analysts, penetration testers, and auditors who need a solid foundation of security principles so they can be as effective as possible at their jobs

Anyone new to information security with some background in information systems and networking.

Prerequisites

SEC401 Security Essentials Bootcamp Style covers all of the core areas of security and assumes a basic understanding of technology, networks, and security. For those who are brand new to the field with no background knowledge, SEC301: Intro to Information Security would be the recommended starting point. While SEC301 is not a prerequisite, it will provide the introductory knowledge that will help maximize the experience with SEC401.

You Will Be Able To

Design and build a network architecture using VLANs, NAC, and 802.1x based on advanced persistent threat indicators of compromise

Run Windows command line tools to analyze the system looking for high-risk items

Run Linux command line tools (ps, ls, netstat, etc.) and basic scripting to automate the running of programs to perform continuous monitoring of various tools

Install VMWare and create virtual machines to create a virtual lab to test and evaluate tools/security of systems

Create an effective policy that can be enforced within an organization and design a checklist to validate security and create metrics to tie into training and awareness

Identify visible weaknesses of a system using various tools and, once vulnerabilities are discovered, cover ways to configure the system to be more secure

Build a network visibility map that can be used for hardening of a network - validating the attack surface and covering ways to reduce that surface by hardening and patching

Sniff open protocols like telnet and ftp and determine the content, passwords, and vulnerabilities using WireShark.

Hands-on Training

SEC401 is an interactive hands-on training course. The following are some of the lab activities that students will carry out:

Setup of virtual lab environment

Windows/Linux tutorial

TCP dump analysis

WireShark decoding of VoIP traffic

Password cracking

Host-based discovery with Dumpsec

Hashing to preserve digital evidence

Analyzing networks with hping and nmap

Event correlation with Splunk

Use of steganography tools

Securing a Windows system with MBSA and SCA

Author Statement

"One of the things I love to hear from students after teaching Security 401 is 'I have worked in security for many years and after taking this course I realized how much I did not know.' With the latest version of Security Essentials and the Bootcamp, we have really captured the critical aspects of security and enhanced those topics with examples to drive home the key points. After you have attended Security 401, I am confident you will walk away with solutions to problems you have had for a while, plus solutions to problems you did not even know you had."

Downloads

Share

As a SysAdmin, I found this course invaluable. It not only gave me the skills I need to audit my own systems, but also gave me some insight on how to better work with external auditors.Christoper O'Keefe